In Splunk, a variable for a macro is defined by placing the variable name inside dollar signs, like this:
$variable name$. This syntax allows the macro to dynamically replace the variable with the appropriate value when the macro is invoked within a search. Using this method ensures that the search strings can be dynamically adjusted based on the variable's value at runtime.
References:
* Splunk Docs: Use macros
* Splunk Answers: Defining and Using Macros